
Insider Threats: In the FLchain system, the MEC servers can be semi-trusted in the training process. Under this assumption, the MEC servers may be honest but curious about the parameter updates and thus can infer some sensitive information from transactions on the blockchain. More specifically, although the data is not explicitly shared in the original format, it is still possible for curious MEC servers to steal the training data from gradients and reconstruct the raw data approximately, especially when the architecture and parameters are not completely protected [1]}. Moreover, malevolent clients can exploit and learn data structure such as image pixels extracted from the global model update without the consent of other clients and MEC servers.

External Threats: At the client side, an adversary can modify data feature or inject an incorrect subset of data in the original dataset to embed backdoors into the model, aiming to adjust the training objective of local clients. An attacker can also compromise some client devices, and the attacker manipulates the local model parameters on the compromised client devices during the learning process which results in errors in the global model update [2]}. Moreover, adversaries can deploy attack on the wireless communication channels during the FL training to gain personal information of clients. For example, an adversary can retrieve the sensitive user information mixed in the parameter update package, e.g., age and user preference [3]}. Further, external eavesdroppers can gain unauthorized access to the MEC servers in order to take control of the model update aggregation procedure.

